Well, as we dive into a conversation around security architecture, it's
incredibly important
for us to pause and recognize a couple of things.
First and foremost, security moves in a mile a minute, meaning that it's
constantly changing
Cisco's portfolios, constantly evolving.
And there's a lot of products that used to be known by one name and now they're
known
by another name.
And then Cisco goes and acquires a new company and introduces that product into
the portfolio.
And so nothing in this conversation should be used to plan purchases and make WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And so nothing in this conversation should be used to plan purchases and make
design
decisions in real world networks.
Instead, it should be a foundational conversation to say, okay, I understand
how Cisco's architecture
kind of comes together.
I understand what products do what?
Let me go talk to my Cisco rep or go talk to my Cisco partner and say, okay,
this is
my understanding of what I think I need.
And they'll say, well, okay, that's great, but this product is now this product
and so
on and so forth.
In fact, that's going to impact us during this conversation because there are
quite a
few products that are on this exam blueprint that are no longer part of the WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
few products that are on this exam blueprint that are no longer part of the
Cisco portfolio
because they've been renamed.
And so they're still there, but they don't have the same name.
And yet we might be asked a question about a product that his name has changed.
And so we need to make sure we know both names.
And it's just all part of the security game.
We've got to make sure we are on top of things when it comes to network
security because
our threat actors are constantly evolving their approaches to compromising our
networks. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
networks.
And they're trying to get to our sensitive data so they can sell it on the dark
web or
they're trying to deploy ransomware, whatever the situation is.
And we have to be constantly vigilant and putting the right products in place.
And Cisco believes that they have a pretty powerful portfolio.
And that's just it.
Cisco has a fairly large architecture.
It's not just, hey, deploy a Cisco firewall here and deploy maybe a Cisco email
security
appliance over here.
It's, hey, we can deploy an entire architecture that is designed to give us WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
It's, hey, we can deploy an entire architecture that is designed to give us
comprehensive
security and they can all feed together or work together and feed a single
source of
information that we can then use to know what's happening inside of our network
.
And so when we think about what security traditionally has been, we've got to
offer
our protections.
So what are we protecting our network from?
Well naturally we want to protect our network against threats.
But these threats can come in a lot of different forms. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
But these threats can come in a lot of different forms.
We've got these bad guys out here, the threat actors, and they're trying to get
in to our
network.
So here's our network.
We've got some things on the network like user machines.
We've got some servers.
We've got data and storage and they're trying to get into this network so they
can
access all these juicy targets that they're trying to get after.
And so we used to deploy a firewall in here and that would hopefully stop them
from getting
on the network.
And so we would certainly want to deploy or protect rather from various traffic WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And so we would certainly want to deploy or protect rather from various traffic
coming
from the web or the internet because these threat actors might live in a
different country
and yet they can access our network through the internet.
And so that's why we deploy a firewall here at the edge.
But these days most of the threats aren't necessarily coming from the internet.
And yes a firewall is still necessary but threat actors are well aware that
these firewalls
pretty much exist in every network. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
pretty much exist in every network.
So what are they doing instead?
Well instead they are trying to deploy software packages especially malware
here on to a user
machine.
Now they have a launching point for their attacks.
So they're trying to launch attacks from inside the network meaning that they
bypassed effectively
they bypassed this firewall.
So it's kind of an interesting concept.
So we have to be well aware of the fact that malware is a very large threat. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So we have to be well aware of the fact that malware is a very large threat.
Malware isn't just software that kind of ruins our productivity and makes it so
our PCs
don't work as well.
This is very very dangerous.
This can provide our threat actors again a launch point for attacks on the
network.
Now from an internal device a device that is already on the network and doesn't
have
to go through the firewall in a lot of cases.
We also have to be worried about how the malware gets installed on the user PCs WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
We also have to be worried about how the malware gets installed on the user PCs
.
And so we have to think about email security because we might have email ph
ishing scams
out there where links are sent out and these phishing scams can be very
sophisticated to
the point that even people in IT I mean like me and you might actually be
fooled.
I've been very close to clicking on links that are phishing links because it's
not just
any more an email that has bad spelling that's clearly not from a legitimate
user but they
disguise themselves and tell a really good story and make me think that hey WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
disguise themselves and tell a really good story and make me think that hey
this is somebody
I know and they're sending me a link it's pretty scary these days how good
email phishing
scams can be.
And so we have to really think comprehensively about all of these different
components and
how everything kind of needs to come together such that we can not only protect
from these
different threats but also explore maybe unique ways of preventing these
threats from being WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
threats from being
effective when maybe an email phishing or maybe I should say a phishing email
does come
through the system and it does land on somebody's machine.
What if they do click on that link how do we protect the network from them
clicking on
that link and how do we detect if this phishing email resulted in malware
getting deployed
and now the malware is performing attacks on the network we need to be able to
detect
that as well.
So this used to require a centralized solution that would be known as a SEAM or WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So this used to require a centralized solution that would be known as a SEAM or
sometimes
a SIM but this stands for security information and event manager.
This is a software package that's going to bring information in from all kinds
of different
security appliances and different security software packages and me as an admin
I can
in theory log into one of these and be able to hopefully very quickly be able
to tell
what's happening on my network if there are any network threats. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
what's happening on my network if there are any network threats.
Well that's great and all except Sims used to be and still are very complex in
nature
to the point that it required multiple admins and potentially a security
operations center
or SOC which is sort of like a network operations center or a NOC but now
dedicated for security.
Well this led to a Cisco creation and really it's an industry wide creation but
Cisco
has a product known as the XDR and this stands for the extended detection and WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
has a product known as the XDR and this stands for the extended detection and
response.
Now again it's not just a Cisco creation they do have a product called XDR and
by the
way the X stand it comes from extended so XDR being response here.
Cisco has a product known as Cisco SDXDR but other security companies also have
similar
products but either way the XDR is similar to a SIM however it's intended to be WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
products but either way the XDR is similar to a SIM however it's intended to be
much
more simple as well as very effective visualization.
One of the problems with security platforms over time has been that I can get
into a
software package like this and it lists out hundreds if not thousands of alerts
.
It's actually a tale of his oldest time that we've got some large corporation
and they
end up getting compromised or hacked and a bunch of data gets stolen and it WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
end up getting compromised or hacked and a bunch of data gets stolen and it
turns out
that this hacking attempt was actually listed inside of one of their monitoring
solutions.
It was right there but it's really hard to see that one line in the middle of
dozens
or hundreds or thousands of what we might call false positives.
These readings that could be a threat but probably isn't a threat and it's hard
for
us as humans to be able to filter all of that out and so XDR is supposed to WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
us as humans to be able to filter all of that out and so XDR is supposed to
help us out
in this regard.
Now Cisco's XDR specifically is going to leverage the concept of a priority
score and that priority
score is out of a thousand.
The higher the priority the greater the threat.
So if we see something that has a priority score of 15 probably not a big deal
but if
we have a priority score of 950 well that one we probably better go try to WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
we have a priority score of 950 well that one we probably better go try to
figure out right
away.
Now there's one other Cisco software package that we want to be aware of.
This exists up in the cloud and this is known as Talos Intelligence.
Talos is a Cisco product that came through an acquisition and it's essentially
this gigantic
cloud database of all kinds of different threats and one of the things that WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
cloud database of all kinds of different threats and one of the things that
does very very
well is it analyzes different files to be able to figure out our files say for
not.
And this is pretty interesting and we'll talk about how exactly it works coming
up.
Now why Talos?
Well Talos in Greek mythology was this defender of the island or isle of Crete
and so Cisco
views Talos as a defender of networks.
And so when we look at all of these different Cisco products.
So Cisco's got an entire suite of products here. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So Cisco's got an entire suite of products here.
They are getting information and sharing information with Talos.
It's sort of the centralized platform that's going to bring all of this
information together
but also share information and if we think about it or realize there's other
corporations
out here.
So there's another corporation if I'm corporation A and their corporation B and
they have an
alert go off like hey this file turned out to be malware and they share that WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
alert go off like hey this file turned out to be malware and they share that
with Talos.
Talos is then going to share that down with our malware protection which is AMP
in our
case.
So our anti malware protection or advanced malware protection but either way AM
P is going
to understand that hey this particular file is actually malware and so maybe
this file
exists in my network and I can go delete it and I am aware of that because it
already
triggered somewhere else in the world. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
triggered somewhere else in the world.
So that's the advantage of having this sort of centralized cloud architecture
and that's
exactly what Talos brings.
So from here we're going to start exploring Cisco's security suite.
As I mentioned this is based on the blueprint we're going to talk about
products like AMP
and make sure we understand what that is even if the name has changed in the
modern
Cisco security architecture.
But regardless we're going to come away from this conversation with a much
better understanding
of what the security architecture looks like and how Cisco views security WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
of what the security architecture looks like and how Cisco views security
products in their
suite as far as how we would deploy them into enterprise networks.